Citrix NetScaler Hacks Escalate to Mass Exploitation

Attacks on Citrix NetScaler appliances have escalated from targeted intrusions into mass exploitation, with researchers documenting custom web shells, tunneling malware, credential theft and movement into internal networks — and Google's Mandiant tracing the campaign back to early September by suspected state-linked actors.

Key facts

They are not just gaining access — they are settling in.

Mandiant recovered several lightweight PHP web shells staged in files using .deb and .sig extensions, providing direct command execution and automated persistence on the appliance. Some used filename variations of "nginstaller." WHIPSHOT, a newly documented custom web shell, hides Base64-encoded command-and-control traffic inside ordinary HTTP headers to blend with normal traffic.

SLAPSHOT is a Python-based TCP tunneling tool that bridges the compromised NetScaler and internal devices, letting attackers reach further into the network. A web shell is a small script placed on a compromised server that gives an attacker a remote command line. Tunneling malware turns that foothold into a route onto everything behind it.

Mandiant CTO Charles Carmakal said the threat actor deployed web shells on compromised NetScaler systems and moved laterally into internal networks at some targeted organizations.

The purpose of that combination is internal reconnaissance, lateral movement and credential harvesting — the preparation phase before whatever comes next.

Longer than the public disclosure suggests. GreyNoise detected a threat actor attempting zero-day exploitation against a Citrix NetScaler Gateway on September 24, more than three days before Citrix publicly disclosed the flaws. Mandiant has since traced CVE-2026-88772 exploitation to early September.

The Dutch National Cyber Security Centre sent a pre-notification to Dutch organizations before any CVE identifiers existed. Citrix published its advisory September 27 alongside patches for eight critical and high-severity NetScaler vulnerabilities.

Because a working exploit became public. Xavier Bellekens, CEO of threat intelligence firm Lupovis, told Help Net Security that their sensor network began recording live exploitation attempts within minutes of watchTowr Labs releasing a proof-of-concept exploit for CVE-2026-88771. A proof of concept is working code demonstrating that a vulnerability is exploitable — useful for defenders testing their exposure, and equally useful to attackers.

There is currently no public proof of concept for CVE-2026-88772, the flaw used by the original attackers.

Bellekens's summary: organizations running unpatched NetScaler should assume they are already being probed.

No. Disabling DTLS and blocking UDP/443 mitigates only CVE-2026-88772. CVE-2026-88771 affects all NetScaler ADC and Gateway deployments regardless of configuration, and the two can be exploited independently. Patching is the only complete fix.

Affected versions include NetScaler ADC and Gateway v14.1 before 14.1-73.37 and v13.1 before 13.1-64.23, NetScaler ADC FIPS before 14.1-73.37 FIPS, and FIPS/NDcPP before 13.1-37.279. Citrix says Secure Private Access Hybrid deployments using NetScaler instances are also affected.

That is now the more important question. Citrix advised customers to upgrade, then check for evidence of compromise and run incident response if they find any.

Patching closes the door; it does not remove someone already inside. Because attackers harvested credentials and established persistence, the compromise-response sequence matters: preserve evidence, isolate the device, revoke credentials and access, investigate every system the NetScaler connected to, rebuild and update firmware, and rotate all local account passwords, Key Encryption Keys and SSL certificates.

Mandiant and Google Cloud have published indicators of compromise, and Citrix has made generic indicators available through NetScaler Console.

Sources: BleepingComputer; Help Net Security; Cybersecurity Dive; Google Cloud Threat Intelligence.